What happens when crypto exchanges use phone based identity checks without strong risk signals?

When a phone check becomes a weak identity signal

Phone based checks often feel stronger than they are because they verify a reachable number, not a trustworthy person. If the exchange treats that signal as proof of control or legitimacy, it can miss common failure modes such as SIM swap, number recycling, voicemail takeover, port out fraud, or a number tied to a different owner. The result is a brittle control that can be satisfied by an attacker or by stale telecom data.

That matters because phone checks usually sit inside a broader onboarding or step-up flow. When the signal is weak, the exchange may approve a session, account change, or withdrawal path that should have been held for stronger verification. In practice, the weakness is not the phone number itself, but the decision to assign it more trust than it deserves.

For exchanges, the key question is whether the phone step is merely one factor among several or the deciding factor. If it is the deciding factor, the control is too easy to satisfy and too hard to defend when the number has been reassigned, intercepted, or temporarily controlled by someone other than the applicant.

Why weak risk signals create false assurance

Strong identity decisions depend on more than possession of a live phone number. Reputation, account history, device continuity, transaction context, and prior ownership evidence help answer a different question: is this the same user, on the same device, in a pattern that matches expected behaviour? Without those signals, the exchange may know only that a number can receive a code, not that the applicant should be trusted.

That false assurance is especially dangerous in financial workflows. A successful phone challenge can become the last gate before balances, withdrawals, password resets, or payout changes. If the verification layer does not bind the number to the right person and risk context, an attacker may only need temporary access to a number to cross the line into account control.

Current guidance in digital identity continues to move away from phone based verification as a high assurance control for sensitive access decisions. The practical lesson is simple: a reachable phone can support recovery or contact, but it should not be treated as strong proof of identity on its own.

What attackers exploit after a phone check passes

Once an exchange accepts a weak phone based check, the attacker’s path is usually short. They can complete account takeover, change recovery settings, add withdrawal addresses, or initiate high risk transactions before the victim notices. The control failure is attractive because it turns a low-friction signal into a fast route to monetisation.

The attack does not require the phone number to be permanently stolen. A brief compromise window, a recycled number, or a poorly validated reassignment can be enough. That means the operational risk is not limited to obvious fraud cases. It also includes silent failures where the exchange believes verification succeeded while the underlying ownership assumption was never true.

For this reason, phone based checks should be treated as a weakly bound signal unless they are reinforced by stronger possession, device, behavioural, or transaction context evidence. Without that reinforcement, the verification step can become an attacker-enabling trust shortcut rather than a control.

Risk and Threat Considerations

Weak phone based verification creates a concentrated trust problem: the exchange may accept a signal that is easy to compromise, easy to recycle, and hard to interpret in isolation. That can expose onboarding, recovery, and withdrawal flows to takeover and fraud even when the number itself appears valid.

Failure mechanism: The exchange relies on a reachable number as evidence of identity or control, but the number may be swapped, reassigned, proxied, or otherwise disconnected from the true applicant. The attacker only needs to satisfy the telecom signal, not establish durable ownership.

Impact: A successful check can unlock account recovery, withdrawals, or other high value actions, creating direct financial loss, customer harm, and a misleading sense that the account was securely verified.

Practitioner Guidance

What to verify: Treat the phone step as a contextual signal, not a stand-alone trust decision. Verify whether the number has recent change history, whether the device and session are consistent with prior usage, and whether the transaction being approved is proportionate to the assurance level available.

Decision rule: If a phone check is being used to approve account recovery, withdrawal changes, or other value-moving actions, require additional risk signals before proceeding. If those signals are absent, route the case to a higher assurance path rather than trying to compensate with more SMS friction.

Practitioner takeaway: The control should answer whether the applicant is plausibly the right user in the right context, not merely whether a number can receive a code.

Related resources from NHI Mgmt Group

• How should financial services teams use phone-based identity signals to reduce fraud without slowing onboarding?
• How should crypto exchanges reduce the risk of deepfake-based identity fraud in user onboarding?
• What happens when insurers issue policies without strong electronic identity checks?
• Why do phone-based possession and reputation signals reduce identity fraud risk?